SCAZT Practice Exam 2 — 20 Questions

Question 1

You are integrating Cisco Secure Access with an IdP. What protocol is used to facilitate this authentication?

Accepted Answer

SAML 2.0. SAML (Security Assertion Markup Language) is the standard protocol used by Cisco Secure Access for cloud-based identity federation.

Answer

LDAP

Answer

SNMP

Answer

ICMP

Question 2

Which Cisco technology provides visibility and control over SaaS applications using API-based integration to inspect data at rest?

Accepted Answer

Cisco Cloudlock. Cisco Cloudlock is an API-based CASB that monitors data at rest in SaaS applications by connecting directly to the cloud provider's APIs.

Answer

Cisco Secure Firewall

Answer

Cisco Stealthwatch

Answer

Cisco Umbrella

Question 3

You are configuring a SASE design to secure traffic from a branch office to the cloud. What is the recommended method for routing internet-bound traffic from the branch to the Cisco Umbrella SIG?

Accepted Answer

Establish an IPsec tunnel from the branch edge device to the nearest Umbrella data center.. IPsec tunnels from the branch edge device (such as a Cisco ISR or Meraki MX) to the Cisco Umbrella SIG provide a secure, encrypted transit for all traffic.

Answer

Configure DNS forwarding only.

Answer

Use an AnyConnect agent on every endpoint in the branch.

Answer

Deploy a local proxy server that intercepts all traffic.

Question 4

You are configuring a Cisco Cloudlock policy to detect sensitive data in a Salesforce environment. You need to identify instances where credit card numbers are shared publicly. Which specific policy category should you configure?

Accepted Answer

Data Exposure. The Cisco Cloudlock Data Loss Prevention engine uses specific policy categories to identify PII/PCI data, and 'Data Exposure' is the correct category for monitoring sharing settings.

Answer

User Behavior Analytics

Answer

Application Firewall

Answer

Threat Intelligence

Question 5

When designing a Zero Trust architecture using Cisco Secure Access, how does the 'Device Posture' check specifically influence the access decision for a managed laptop?

Accepted Answer

It requires the presence of an MDM-enrolled certificate or specific registry key before authorizing the session.. Device posture checks in Cisco Secure Access verify the health and security configuration of the endpoint before granting access to protected applications.

Answer

It switches the user's connection to a VPN tunnel.

Answer

It forces a mandatory password reset if the device is out of compliance.

Answer

It checks the user's IP address against a geo-blocking database.

Question 6

Which term describes the unauthorized use of cloud applications by employees within an organization?

Accepted Answer

Shadow IT. Shadow IT refers to applications or software used within an organization without explicit IT department approval.

Answer

Zero Trust

Answer

Cloud-Native

Answer

BYOD

Question 7

When configuring Cisco Umbrella for SaaS, how does SSL inspection impact the visibility of application traffic?

Accepted Answer

It enables deep packet inspection of SaaS content.. SSL inspection decrypts traffic, allowing the proxy to inspect the actual payload, which is essential for granular visibility and DLP enforcement within SaaS apps.

Answer

It blocks all encrypted traffic.

Answer

It decreases application performance.

Answer

It removes the need for DNS filtering.

Question 8

Which TWO factors are critical when configuring an automated remediation workflow in Cisco Cloudlock to prevent data loss?

Accepted Answer

Action selection (e.g., Delete, Notify, Quarantine).. Effective remediation requires an action (what to do) and a trigger condition (when to do it based on policy severity).

Answer

Manual user approval for every file deletion.

Answer

Hardware firewall throughput settings.

Answer

Network bandwidth throttling configuration.

Question 9

You have configured a DLP policy in Cisco Cloudlock that flags files shared with external users. You notice files shared with 'Anyone with the link' are not being flagged. What is the most likely configuration error?

Accepted Answer

The scope of the policy is set to 'internal' only.. Cloudlock policies require the specific permission level (e.g., 'Public' or 'Anyone with link') to be explicitly selected in the 'Exposure' criteria of the policy engine.

Answer

SSL inspection is not enabled.

Answer

The user is an administrator.

Answer

The API token for the SaaS has expired.

Question 10

Which THREE criteria can be used to classify a 'Shadow IT' application in Cisco Umbrella?

Accepted Answer

Volume of traffic. Shadow IT identification is based on traffic volumes, application category, and risk scores assigned by Umbrella.

Answer

User's password hash

Answer

Device serial number

Question 11

Which TWO settings should be verified if a Cisco Cloudlock API connector to Google Workspace is showing a 'Warning' status?

Accepted Answer

Service account permissions. Connector warnings usually stem from insufficient API permissions (scopes) or expired credentials/tokens.

Answer

Network bandwidth usage

Answer

Physical server cooling status

Answer

Local DNS server settings

Question 12

In Cisco Cloudlock, why would you use a 'Custom Regex' pattern in a DLP policy?

Accepted Answer

To detect non-standard sensitive data formats.. Custom Regex patterns allow you to define organization-specific sensitive data formats, such as employee ID numbers or unique project code formats, that aren't in standard templates.

Answer

To increase the storage limit.

Answer

To scan files faster.

Answer

To bypass file encryption.

Question 13

When implementing a ZTNA solution, which factor is most crucial when defining an 'Application Access Policy'?

Accepted Answer

The identity of the user and the specific application they require.. In ZTNA, policies must be defined based on the user identity and the specific application, rather than network segments.

Answer

The physical location of the cloud data center.

Answer

The source IP address of the user's laptop.

Answer

The user's department in Active Directory.

Question 14

When deploying a secure remote access solution, how do you handle 'Split Tunneling' safely in a Zero Trust environment?

Accepted Answer

Use a ZTNA agent to tunnel only application-specific traffic while keeping web traffic direct.. By using a ZTNA agent, you can define specific application tunnels, effectively creating a 'split' where only authorized traffic goes through the secure path while general web traffic goes direct.

Answer

Disable split tunneling to ensure all traffic is inspected.

Answer

Force all traffic through the corporate VPN, regardless of destination.

Answer

Allow all traffic to the internet without any inspection.

Question 15

Which THREE factors are typically considered when evaluating 'Device Posture' in a Zero Trust environment?

Accepted Answer

Disk encryption status. Posture checks commonly look at OS patches, antivirus status, and disk encryption to determine device health.

Answer

The user's home internet speed

Answer

The user's favorite website

Question 16

Which THREE components are critical to consider when designing a 'cloud security reference architecture'?

Accepted Answer

Identity and Access Management (IAM). A complete architecture must account for identity, workload protection, and internet edge security.

Answer

Physical server cooling systems

Answer

The brand of the office chair

Question 17

Which component is required to allow Umbrella to perform SSL decryption on web traffic?

Accepted Answer

Deployment of the Umbrella Root CA. To perform SSL decryption, the Umbrella Root CA certificate must be installed on all client endpoints to prevent browser certificate warnings.

Answer

DNS-over-HTTPS setup

Answer

VPN client configuration

Answer

Public IP whitelisting

Question 18

Which THREE items are included in a Cisco Cloudlock 'Incident' report?

Accepted Answer

Severity level. Cloudlock incidents provide detailed context including the user involved, the severity of the violation, and the specific file or resource affected.

Answer

BIOS version

Answer

User's home Wi-Fi SSID

Question 19

Which TWO methods can Cisco Cloudlock use to notify an administrator of a policy violation?

Accepted Answer

Email notification. Cloudlock provides multiple notification channels, including email alerts and integration with webhooks/ticketing systems.

Answer

Physical alarm sound

Answer

Automated phone call

Answer

SMS text message

Question 20

Which THREE mechanisms are commonly used by a CASB to enforce access control to SaaS applications?

Accepted Answer

API-based integration.. CASB enforces access via API integration, forward proxy, and reverse proxy architectures.

Answer

Local host firewall rules.

Answer

Direct switch-to-server connection.